thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Improper Credential Usage

Mobile Top 10 2024 risk (M1) covering hard-coded credentials, insecure credential transmission and storage, and weak authentication of the app to backends.

Definition

Developers often embed API keys or service passwords in mobile apps, where they are easily extracted. Mitigations include never hard-coding credentials, using per-user OAuth tokens, storing secrets in platform keystores, transmitting them only over TLS and rotating keys.

Example

A cloud storage admin key is found in an app's resources file.

Exam tip

Anything shipped in an app binary should be considered public.

Related terms